[PATCH 1/1] mshtml: Fix buffer underflow in range_to_string.

[Yuxuan Shui]

From: Yuxuan Shui

range_to_string scans the buf from right to left for whitespaces. If the buf
contains only whitespaces, we will scan past the start of the buf.
---
 dlls/mshtml/range.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index 81b921a615a..89bc8426f1a 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -503,7 +503,7 @@ static void range_to_string(HTMLTxtRange *This, wstrbuf_t *buf)
     if(buf->len) {
         WCHAR *p;

-        for(p = buf->buf+buf->len-1; p >= buf->buf && iswspace(*p); p--);
+        for(p = buf->buf+buf->len-1; p > buf->buf && iswspace(*p); p--);

p = wcschr(p, '\r');
         if(p)